Changeset 51362 for trunk/src/wp-includes/blocks.php

Timestamp:

07/06/2021 11:55:44 PM (5 years ago)

Author:

peterwilsoncc

Message:

Block Editor: Update packages with latest fixes for 5.8 RC2

Includes the following fixes:

• Query Block: Type validation of WP_Query parameters.

Props ntsekouras, stevehenty, peterwilsoncc, desrosj.
Fixes #53397.

File:

• trunk/src/wp-includes/blocks.php (modified) (3 diffs)

trunk/src/wp-includes/blocks.php

@@ -1058 +1058 @@
 
         if ( isset( $block->context['query'] ) ) {
-                if ( isset( $block->context['query']['postType'] ) ) {
-                        $query['post_type'] = $block->context['query']['postType'];
+                if ( ! empty( $block->context['query']['postType'] ) ) {
+                        $post_type_param = $block->context['query']['postType'];
+                        if ( is_post_type_viewable( $post_type_param ) ) {
+                                $query['post_type'] = $post_type_param;
+                        }
                 }
                 if ( isset( $block->context['query']['sticky'] ) && ! empty( $block->context['query']['sticky'] ) ) {
@@ -1069 +1072 @@
                         }
                 }
-                if ( isset( $block->context['query']['exclude'] ) ) {
-                        $query['post__not_in'] = array_merge( $query['post__not_in'], $block->context['query']['exclude'] );
-                }
-                if ( isset( $block->context['query']['perPage'] ) ) {
-                        $query['offset']         = ( $block->context['query']['perPage'] * ( $page - 1 ) ) + $block->context['query']['offset'];
-                        $query['posts_per_page'] = $block->context['query']['perPage'];
-                }
-                if ( isset( $block->context['query']['categoryIds'] ) ) {
-                        $query['category__in'] = $block->context['query']['categoryIds'];
-                }
-                if ( isset( $block->context['query']['tagIds'] ) ) {
-                        $query['tag__in'] = $block->context['query']['tagIds'];
-                }
-                if ( isset( $block->context['query']['order'] ) ) {
+                if ( ! empty( $block->context['query']['exclude'] ) ) {
+                        $excluded_post_ids     = array_map( 'intval', $block->context['query']['exclude'] );
+                        $excluded_post_ids     = array_filter( $excluded_post_ids );
+                        $query['post__not_in'] = array_merge( $query['post__not_in'], $excluded_post_ids );
+                }
+                if (
+                        isset( $block->context['query']['perPage'] ) &&
+                        is_numeric( $block->context['query']['perPage'] )
+                ) {
+                        $per_page = absint( $block->context['query']['perPage'] );
+                        $offset   = 0;
+
+                        if (
+                                isset( $block->context['query']['offset'] ) &&
+                                is_numeric( $block->context['query']['offset'] )
+                        ) {
+                                $offset = absint( $block->context['query']['offset'] );
+                        }
+
+                        $query['offset']         = ( $per_page * ( $page - 1 ) ) + $offset;
+                        $query['posts_per_page'] = $per_page;
+                }
+                if ( ! empty( $block->context['query']['categoryIds'] ) ) {
+                        $term_ids              = array_map( 'intval', $block->context['query']['categoryIds'] );
+                        $term_ids              = array_filter( $term_ids );
+                        $query['category__in'] = $term_ids;
+                }
+                if ( ! empty( $block->context['query']['tagIds'] ) ) {
+                        $term_ids         = array_map( 'intval', $block->context['query']['tagIds'] );
+                        $term_ids         = array_filter( $term_ids );
+                        $query['tag__in'] = $term_ids;
+                }
+                if (
+                        isset( $block->context['query']['order'] ) &&
+                                in_array( strtoupper( $block->context['query']['order'] ), array( 'ASC', 'DESC' ), true )
+                ) {
                         $query['order'] = strtoupper( $block->context['query']['order'] );
                 }
@@ -1088 +1113 @@
                         $query['orderby'] = $block->context['query']['orderBy'];
                 }
-                if ( isset( $block->context['query']['author'] ) ) {
-                        $query['author'] = $block->context['query']['author'];
-                }
-                if ( isset( $block->context['query']['search'] ) ) {
+                if (
+                        isset( $block->context['query']['author'] ) &&
+                        (int) $block->context['query']['author'] > 0
+                ) {
+                        $query['author'] = (int) $block->context['query']['author'];
+                }
+                if ( ! empty( $block->context['query']['search'] ) ) {
                         $query['s'] = $block->context['query']['search'];
                 }